Technical information
Malicious functions:
Sends SMS messages:
- 13840272844: <SMS Content>
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) www.lly####.com:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) www.ao####.com:80
- TCP(HTTP/1.1) ak.im####.com.####.net:80
- TCP(HTTP/1.1) global-####.w####.com.####.net:80
- TCP(HTTP/1.1) lly####.com:80
- TCP(HTTP/1.1) su####.g.doublec####.net:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) dp.g.doublec####.net:80
- TCP(HTTP/1.1) mcc.god####.com:80
DNS requests:
- ak2.im####.com
- api.q####.top
- dp.g.doublec####.net
- i####.w####.com
- l####.tbs.qq.com
- lly####.com
- mcc.god####.com
- paoniu5####.0####.b####.com
- su####.g.doublec####.net
- www.ao####.com
- www.ao####.com
- www.go####.com
- www.gst####.com
- www.lly####.com
HTTP GET requests:
- dp.g.doublec####.net/apps/domainpark/domainpark.cgi?r=m&domain_name=llys...
- dp.g.doublec####.net/static/caf/slave.html
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w4.ttf
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w8.ttf
- lly####.com/?reqp=####&reqr=####
- lly####.com/favicon.ico
- lly####.com/img.aspx?q=L3MkW####
- mcc.god####.com/park/rKyfMzy2Ll5jLab=
- su####.g.doublec####.net/async_survey?site=####
- su####.g.doublec####.net/gk/prompt?t=####&site=####&random=####&ref=htt#...
- su####.g.doublec####.net/insights/consumersurveys/static/403990792351279...
- www.ao####.com/
- www.ao####.com/categories/
- www.go####.com/adsense/domains/caf.js
- www.go####.com/dp/ads?r=m&domain_name=llysvip.com&client=dp-godaddy1_xml...
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
HTTP POST requests:
- l####.tbs.qq.com/ajax?c=####&k=####
Modified file system:
Creates the following files:
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbs_report_lock.txt
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/WebpageIcons.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/tbs_load_stat_flag.xml
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
Uses the following algorithms to encrypt data:
- RSA-ECB-NoPadding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
